Notice. This Agreement is accepted electronically by a school account owner or admin. It is not a government FERPA certification and does not replace the School’s FERPA notices, consents, or board policies. With respect to Student Data, this Agreement controls over conflicting marketing or summary language.
1. Introduction & purpose
This Student Data Privacy Agreement (“Agreement” or “DPA”) is between InternPick.com (“InternPick,” “Provider,” “we,” “us,” or “our”) and the school, district, or authorized educational organization (“School,” “LEA,” or “you”) that accepts it when creating or administering a school workspace on InternPick.
InternPick provides software that helps Schools coordinate work-based learning and internship programs — including student invitations, applications, placements, hours tracking, messaging, and related compliance workflows the School enables.
This Agreement is designed to support the School’s FERPA program by establishing InternPick as a school official under the School’s direct control with respect to Student Data processed through the Service. It is not a government certification and does not replace the School’s own FERPA notices, consents, or board policies.
Electronic acceptance (typed legal name and explicit agree) has the same effect as a written signature where permitted by applicable law, including the U.S. ESIGN Act and state equivalents.
2. Definitions
- “Student Data” means personally identifiable information from education records, and other student-related personal information the School or its authorized users enter into or generate through the Service in connection with School programs (for example names, contact details, grade level, applications, placement status, hours logs, and messages about a student).
- “Service” means InternPick.com and related applications and support InternPick provides to the School.
- “Subprocessor” means a third party engaged by InternPick to process Student Data to help deliver the Service (for example hosting, authentication, email delivery, or optional analytics).
- “Authorized Users” means School staff, students, guardians, and host contacts the School invites or configures to use the Service under the School’s account.
3. School official status & legitimate educational interest
In performing the Services, InternPick shall be considered a “school official” with a legitimate educational interest under FERPA (including 34 CFR § 99.31(a)(1)), performing institutional services or functions the School would otherwise use its own employees to perform — namely coordinating and tracking work-based learning and internship programs.
With respect to its use and maintenance of Student Data, InternPick shall be under the direct control of the School. The School exercises that control through this Agreement, role-based access, Settings, program configuration, and instructions the School gives InternPick.
The School is responsible for including school-official criteria in its annual FERPA notification where required, and for ensuring disclosures to InternPick are consistent with district policy.
4. Permitted purpose & use limitations
InternPick will use Student Data only to provide, maintain, secure, and support the Service for the School’s authorized educational purposes, and to comply with law.
InternPick will not use Student Data for targeted advertising, cross-context behavioral advertising, or sale of personal information. InternPick does not sell, rent, or license Student Data for monetary consideration.
InternPick will not redisclose Student Data to third parties except: (a) to Subprocessors under written obligations consistent with this Agreement; (b) to Authorized Users according to access the School configures; (c) with the School’s documented direction; or (d) as required by law (in which case InternPick will notify the School unless legally prohibited).
De-identified or aggregate data that cannot reasonably be used to identify a student may be used to improve Service reliability and security, provided InternPick does not attempt to re-identify individuals.
5. School responsibilities & direct control
- Provide any notices and obtain any consents required under FERPA, COPPA (where applicable), state student-privacy laws, and district policy before entering Student Data.
- Configure roles, invitations, program visibility, guardian consent, and retention settings appropriately for your programs.
- Use the Service only for legitimate educational purposes related to work-based learning coordination.
- Respond to parent and eligible-student requests to inspect or amend education records; InternPick will assist the School as reasonably necessary as a processor/school official.
- Ensure staff and hosts use Student Data only for authorized placement and program purposes.
6. Security measures
InternPick implements commercially reasonable administrative, technical, and organizational measures designed to protect Student Data against unauthorized access, disclosure, alteration, and destruction. These include encryption in transit, access controls, authentication, and operational monitoring appropriate to the Service.
No method of transmission or storage is perfectly secure. The School should report suspected unauthorized access promptly to privacy@internpick.com.
7. Subprocessors
InternPick may engage Subprocessors to host and operate the Service. Current primary infrastructure includes Google Cloud / Firebase for hosting, authentication, database, and file storage. InternPick may also use email delivery providers and, only when a visitor or School enables analytics, analytics tools subject to InternPick’s Cookie Policy.
InternPick will impose contractual confidentiality and data-protection obligations on Subprocessors that process Student Data, and remains responsible to the School for Subprocessor performance under this Agreement.
A living list of subprocessors and a Student Data inventory is published at internpick.com/compliance. A high-level summary also appears for School admins under Settings → Legal.
8. Breach notification
Upon confirming a security incident that results in unauthorized access to, disclosure of, or loss of Student Data processed for the School, InternPick will notify the School without undue delay and, where feasible, within seventy-two (72) hours of confirmation.
Notification will include available details about the nature of the incident, the data categories affected (to the extent known), and remediation steps InternPick has taken or proposes. The School remains responsible for any further notices required to parents, eligible students, or regulators under applicable law.
9. Retention, deletion & return
InternPick retains Student Data while the School’s account is active and as needed to provide the Service, resolve disputes, and comply with law, subject to retention settings the School configures in-product.
Upon School request, account deletion, or termination of the School’s use of the Service, InternPick will delete or de-identify Student Data associated with that School account as described in-product and in the Privacy Policy, except for limited backup copies retained for a short period or data InternPick must retain by law.
Upon reasonable written request before deletion, InternPick will make Student Data available for export in a commonly used format where the Service supports it.
10. Parent & eligible-student requests
Parents and eligible students should direct FERPA access, amendment, and related education-record requests to the School. InternPick does not act as the School of record.
InternPick will reasonably cooperate with the School to support such requests for data held in the Service. Privacy questions about InternPick’s processing practices may be sent to privacy@internpick.com.
11. Priority of agreements
With respect to the treatment of Student Data only, this DPA governs and takes precedence over conflicting terms in InternPick’s marketing materials, Privacy Policy summaries, or Platform Facilitator Agreement. All other provisions of the Platform Facilitator Agreement, Terms of Use, and Privacy Policy remain in effect.
If the School requires a district- or state-specific data privacy agreement (including an SDPC National Data Privacy Agreement or equivalent), the parties may execute that agreement separately; such a signed instrument may supplement or supersede this DPA to the extent expressly stated therein.
12. Changes to this Agreement
InternPick may update this Agreement to reflect changes in the Service, law, or security practices. Material changes will be posted at internpick.com/dpa with a revised version and “Last updated” date. School admins may be prompted in-product to review and re-accept a new version.
Continued use of the Service after a new version becomes effective, or in-product re-acceptance by a School admin, constitutes acceptance of the updated Agreement. If the School does not agree, it must stop entering Student Data and may request account deletion as described in-product.
13. Contact
Questions about this Agreement or requests to share it with counsel: hello@internpick.com.
Privacy and Student Data questions: privacy@internpick.com.
Audience review
Role-specific provisions
The sections below summarize how this document applies to educators, students, and host employers. District counsel may review each block independently.
Educators — schools & staff
This Agreement establishes InternPick as a school official for Student Data the School enters for work-based learning coordination. It supports the School’s FERPA program. It is not a government certification.
- Account owners accept the DPA during create-school onboarding after InternPick Terms; admins may accept later under Settings → Legal.
- Share /dpa with district counsel alongside your local data privacy addendum if required.
- Use Settings → Legal to confirm DPA status and related school controls (consent, insurance, retention, audit trail).
- Joiners and invited staff do not overwrite the school’s DPA acceptance record.
Students & guardians
- Your school decides what student information is entered and who may view placement details.
- InternPick uses student data only to operate features your school enables — not for advertising or sale.
- Parents or guardians with FERPA questions about education records should contact the school; InternPick privacy requests: privacy@internpick.com.
Host employers
- Hosts see student information the school chooses to share for applications, placements, and messaging.
- Use student information only for legitimate placement coordination; do not repurpose it for unrelated marketing.
- The school’s DPA governs how InternPick processes Student Data for that school; hosts remain bound by InternPick Terms and any school host terms.
Where InternPick collects acceptance
The table below maps each onboarding and invite flow to the legal documents presented and how acceptance is recorded. Schools may share this section with district counsel when reviewing InternPick alongside local WBL policies.
School-authored terms (student or host) are optional, configured by each school under Settings → Legal, and are separate from InternPick’s platform documents.
- [Educators] New school account — Platform Facilitator Agreement (/onboarding/platform-agreement): Platform Facilitator Agreement, InternPick Terms v1.1, Privacy Policy, Terms of Use — Scroll through terms, type full legal name, and check explicit agree; acceptance stored on school record with timestamp and policy version.
- [Educators] New school account — Student Data Privacy Agreement (/onboarding/student-data-privacy): Student Data Privacy Agreement v1.0 (FERPA-ready school official terms) — After platform terms, scroll through the DPA, type full legal name, and check explicit agree; acceptance stored on schools/{id}/settings/dpa.
- [Educators] Join existing school (invited staff/admin) (/accept-invite): InternPick Terms v1.1, Terms of Use, Privacy Policy — Checkbox acknowledgment (and typed name where collected) before completing invite; does not overwrite school owner platform or DPA acceptance.
- [Educators] Join existing school (short onboarding path) (/onboarding/platform-agreement): Platform Facilitator Agreement, InternPick Terms v1.1 — Typed legal name + explicit agree on platform agreement step when joining via school invite without creating a new school. Does not write school DPA.
- [Educators] Existing school — accept or re-accept DPA in Settings (/settings/legal/compliance): Student Data Privacy Agreement v1.0 — School admins may accept a missing or updated DPA from Settings → Legal without blocking the workspace. Soft banner prompts admins until current.
- [Hosts] Host invited by a school (/accept-invite): InternPick Terms v1.1; optional school host terms if enabled by the school — Checkbox for InternPick terms; scroll-to-end + checkbox for optional school host terms.
- [Hosts] Register company workspace (business account) (/business/onboarding): Platform Facilitator Agreement, InternPick Terms v1.1, Privacy Policy, Terms of Use — Scroll through terms, type full legal name, and check explicit agree on company profile wizard (after Find company); acceptance stored on business + educator records.
- [Students] Student school invite (/join/[invite-token]): InternPick student terms (includes platform terms); optional school student terms if enabled — Scroll through full terms, then checkbox; optional second scroll + checkbox for school terms.
- [Guardians] Parent/guardian program consent (/parent-consent): Program consent scope, e-sign disclosure, Privacy Policy — Guardian completes consent form; school remains responsible for required authorizations.
- [All users] Public site use (no account) (/terms · /privacy · /cookies · /dpa): Terms of Use, Privacy Policy, Cookie Policy, Student Data Privacy Agreement (reference) — Using the public site constitutes agreement to posted Terms and acknowledgment of the Privacy Policy. The DPA binds schools that accept it in-product.
This page is provided for transparency and does not constitute legal advice. InternPick recommends that schools, hosts, and districts have qualified counsel review these documents alongside local board policy, FERPA programs, and work-based learning requirements before relying on them.